CVE-2026-104458
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 02, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.